Connect & Integrate ADP Workforce Now [Early Preview]

This integration is in early preview and in the process of being tested.

YeshID imports your workers from ADP Workforce Now so onboarding and offboarding stay in sync with your HR system. The integration is read-only: YeshID pulls worker demographics from ADP’s HR Workers API and never writes anything back. ADP remains your system of record.

Setting up the connection in YeshID takes about 15 minutes. Getting API access from ADP is the longer part — it involves either a paid ADP add-on or an ADP support case, and can take from a few hours to a few days depending on the path.

Prerequisites

Before you start, you’ll need:

• An ADP administrator (HR main practitioner) who can purchase Marketplace apps or open a support case with ADP.

• A YeshID administrator to configure the integration.

• One of the two ADP API access paths below. Set aside about 30 minutes for Path 1; Path 2 depends on ADP’s turnaround.

Note: ADP requires mutual TLS — a client certificate presented on every API call — in addition to OAuth credentials. By the end of the ADP-side setup you will have four things: a Client ID, a Client Secret, a client certificate (.pem/.cer file), and the matching private key (.key file).

Step 1 — Get API access from ADP

Path 1: ADP API Central (Workforce Now and Workforce Now Next Gen)

API Central is ADP’s self-service API add-on, purchased on the ADP Marketplace and billed per employee on your ADP invoice.

1. Purchase ADP API Central for ADP Workforce Now from the ADP Marketplace (“Buy Now” on the listing, or through your ADP account representative). It activates within minutes. Access initially lands with whoever made the purchase — they can add you under Members in API Central.

2. Log in at apps.adp.com with your Workforce Now credentials, open My Apps, and launch API Central.

3. Go to Projects → Create Project. Name it (for example, “YeshID”) and choose a use case that includes worker/employee demographic data with contact information — the HR Workers API, read access. ADP has no OAuth scopes; this use-case selection is the permissions step.

4. Copy the project’s Client ID and Client Secret — they’re generated as soon as the project is created.

5. Open Certificate → Request Certificate. The guided flow generates a private key and issues an auto-signed certificate.

   • Note: the private key is shown once. Copy it and save it as a .key file before leaving the page — it cannot be retrieved again.

   • Download the certificate as a .pem file.

Path 2: ADP Integration Services (ADP TotalSource, or if you don’t have API Central)

ADP TotalSource and some other ADP products have no self-service API option. For these, ADP provisions access manually through a support case.

1. Ask your ADP representative to open an API setup request. ADP will assign an Integration Services specialist and send an intake questionnaire.

2. In your reply, tell ADP:

   • Software being connected: YeshID — connects directly to ADP’s REST APIs over mutual TLS; no middleware to build.

   • Data needed: Employment Data — worker demographics, read-only, via the HR Workers v2 API (GET /hr/v2/workers), including work contact information.

   • PII masking: mask DOB, Tax ID, banking info, and pay rates — YeshID does not read or store any of them.

3. Generate a certificate signing request on any machine with OpenSSL:

   openssl req -new -newkey rsa:2048 -nodes -keyout company_auth.key -out company_auth.csr
   

   Use plain ASCII in every prompt, and enter your organization name exactly as it is registered with ADP (special characters are the most common reason ADP rejects a CSR). Keep the .key file safe — it is your private key. Send ADP only the .csr.

4. ADP signs the CSR (usually within 24 hours) and returns the certificate, and separately sends your Client ID and Client Secret by secure email. Those secure links expire — save the values promptly.

Note: ADP case emails often reference a “Client ID” that is your Workforce Now company code (a short code like ACME1). That is not the OAuth Client ID. The OAuth Client ID and Secret are issued separately with your certificate.

Step 2 — Connect ADP in YeshID

1. In YeshID, go to Applications, add ADP, and open the integration setup.

2. On the Authentication tab, enter:

   • Client ID — the OAuth client ID ADP issued.

   • Client Secret — the matching secret.

   • Client Certificate (PEM) — upload the certificate file from ADP.

   • Client Private Key (PEM) — upload your private key file. All four values are stored encrypted.

3. Leave Base URL (https://api.adp.com) and Token URL (https://accounts.adp.com/auth/oauth/v2/token) at their defaults. Only change them if ADP directed you to a sandbox or regional host for a test tenant.

4. Save. YeshID uses the certificate and key to open the mutual-TLS connection and the Client ID/Secret to request access tokens — there is no separate API key, and no Postman step is needed.

Step 3 — Import employees

1. Open the Import Employees action on the ADP application. The first screen pulls a live preview from ADP.

2. Review the field mappings — each ADP field shows a sample value from a real worker so you can confirm data is flowing.

3. Choose who to create, review, and run the import.

Fields imported

Unmapped ADP fields are still imported onto the employee record, and mappings can be adjusted per field in the import wizard.

Notes

• Read-only. YeshID only ever calls ADP’s token endpoint and GET /hr/v2/workers. Nothing is written back, and PII you masked on the ADP side stays masked.

• Certificates expire after two years. ADP emails a notification starting 60 days before expiry. Renewing means repeating the certificate step on your path and uploading the new certificate and key in YeshID.

• Which ADP products work: Workforce Now and Workforce Now Next Gen (via API Central), and ADP TotalSource (via an Integration Services case). Contact us about other ADP products.

Troubleshooting

“invalid ADP client certificate or private key” — The certificate or key file isn’t valid PEM. Open the file in a plain-text editor: a certificate must start with -----BEGIN CERTIFICATE----- (five hyphens, its own line). If the file is binary, convert it: openssl x509 -inform der -in file.cer -out file.pem. To confirm the certificate matches your key, compare openssl x509 -noout -modulus -in cert.pem | openssl md5 with openssl rsa -noout -modulus -in key.key | openssl md5 — the hashes must be identical.

“ADP token request returned status 401” (or 403) — The files parsed, but ADP rejected the credentials. Usually the Client ID/Secret don’t belong to the same project as the certificate, or ADP hasn’t finished enabling API access on their side. Reply on your ADP case or check the API Central project.

Import runs but work email (or another field) is empty — The connection works; ADP isn’t returning that data. The usual cause is the API Central use case (or the data access ADP configured on your case) excluding contact information. Ask ADP to include work contact info in your worker demographic access — no re-issuing of credentials is needed.

Import returns no workers — Check that the API Central project’s use case includes the HR Workers API (/hr/v2/workers); a 403 on that endpoint means the scope is missing from the project.

Questions, or a field that maps oddly on your tenant? Reach out — field mappings can be adjusted per organization.